Updated October 2026: This post has been expanded from its original August 2018 version with the full story of Coinhive, from launch to shutdown, how Japan's courts handled browser mining, why the money was so small, and how to spot and block cryptojacking today. It is a historical account; details describe the time it covers, not today.
In 2017 and 2018, a small piece of JavaScript called Coinhive turned up on tens of thousands of websites. Its pitch sounded almost reasonable: instead of showing you ads, a website could borrow a little of your computer's processing power while you read, use it to mine cryptocurrency, and keep most of the proceeds. In practice, it became the defining tool of a new kind of abuse called cryptojacking, where someone else's hardware is used to mine coins without permission.
The original version of this post, from August 2018, noted how little money the schemes actually made. That turned out to be the whole story in miniature. This rewrite explains how Coinhive worked, why it spread, why it was shut down in 2019, how Japan's courts wrestled with whether it was a crime, and what still matters for protecting your devices today.
How Coinhive worked
Coinhive mined Monero, a privacy-focused cryptocurrency. Monero's mining algorithm was deliberately designed to work on ordinary processors rather than specialized mining chips, which made it practical to mine inside a web browser. That same design is why Monero became the favorite coin of criminals running mining malware.
A website owner signed up, received a site key, and added a few lines of JavaScript to their pages. When a visitor arrived, the script ran in the background and put the visitor's CPU to work on mining calculations. According to reporting by security journalist Brian Krebs, Coinhive kept 30 percent of the Monero mined through its code, and the account tied to the site key received the other 70 percent.
The model was first tested in July 2017 on a German-language imageboard, where about 2,100 users briefly pushed the pool's combined mining power high enough to make it one of the larger pools on the Monero network. Coinhive then opened to the public.
From experiment to epidemic
The trouble started almost immediately. Within weeks, reports surfaced that The Pirate Bay was testing the script. In late September 2017, the miner was found hidden on streaming sites owned by Showtime. In December 2017, it turned up in the Wi-Fi hotspot of a Starbucks in Argentina. In January 2018, researchers found ads served through YouTube that contained mining JavaScript.
Most cases did not involve a website owner choosing to mine. Attackers broke into sites, often through known software flaws, and inserted the script with their own site key. By mid-2018, mining code had been found on more than 300 government and university websites worldwide, all running a vulnerable version of the Drupal content management system.
Coinhive responded in October 2017 with AuthedMine, a version that asked visitors for permission before it started. It made little difference. In March 2018, Krebs reported that a source-code search engine found nearly 32,000 sites running the original Coinhive script and just under 1,200 running AuthedMine. Malwarebytes said it saw AuthedMine in little more than one percent of the Coinhive cases it detected.
There was another criticism. When Coinhive revoked a site key that had been reported for abuse, the mining script on the hacked site did not stop running. A security researcher quoted by Krebs pointed out that, in that situation, Coinhive kept all of the Monero the script continued to produce.
By late 2017, antivirus vendors and the major ad-blocking filter lists had started blocking Coinhive outright. Even so, it stayed dominant. Before it shut down, Coinhive was involved in more than two-thirds of all cryptojacking incidents, according to figures cited in Wikipedia's summary of the research.
- July 2017
Browser mining model tested on a German-language imageboard - September 2017
Coinhive reported on The Pirate Bay and on Showtime-owned streaming sites - October 2017
Coinhive launches AuthedMine, an opt-in version that asks visitors first - Late 2017
Antivirus tools and ad-block lists begin blocking the script - March 2018
A Japanese court issues a summary fine to a web designer who embedded the script - Mid-2018
Mining code found on more than 300 government and university sites running vulnerable Drupal - March 8, 2019
Coinhive stops mining service - April 30, 2019
Coinhive website goes fully offline - January 20, 2022
Supreme Court of Japan acquits the web designer
Why it paid peanuts
The original headline was right: for most people using it, browser mining converted visitors' electricity into very little money. A browser tab can only do a modest amount of mining work, visitors rarely stay long, and the network's total mining power dwarfs any single website.
A widely cited estimate from the period, based on a typical visitor contributing 54 hashes per second for three minutes, shows the scale of the problem:
| Visitors per day | Monero per month | Approx. value per month (2017-18) |
|---|---|---|
| 100 | 0.0086 XMR | about €0.69 |
| 1,000 | 0.086 XMR | about €6.90 |
| 10,000 | 0.86 XMR | about €69 |
Estimate cited by German Wikipedia from bitcoinmag.de. Values depend on Monero's price and network difficulty at the time and are shown only to illustrate scale.
A site with 10,000 visitors a day would typically earn far more than that from conventional display ads. The model made sense mainly for people who were not paying for the electricity or the hardware, which is exactly why it attracted attackers rather than legitimate publishers.
Japan's legal test
Japan became the first country to treat browser mining as a serious criminal question. Police across the country took action against people who installed Coinhive on websites, and by April 2019 the count had reached 21 people.
The most closely watched case involved a web designer who had embedded Coinhive on his own site. He was accused under Article 168-2 of Japan's Penal Code, which covers the creation and use of "unauthorized electromagnetic records," the law commonly used against computer viruses. In March 2018 he received a summary order for a 100,000 yen fine, but he refused to pay and asked for a full trial. His case went through every level of the court system:
- March 27, 2019: The Yokohama District Court acquitted him, finding reasonable doubt about whether the script was a malicious program, and noting that criminal punishment without prior warnings was excessive.
- February 7, 2020: The Tokyo High Court reversed that decision, ruled the script was a virus, and imposed the 100,000 yen fine.
- January 20, 2022: The Supreme Court of Japan overturned the High Court and acquitted him. It found that while the program ran against users' wishes, it was not so improper that society could not tolerate it.
The ruling did not make cryptojacking legal. It turned on the specific facts: a site owner running a script on his own website, at a time when there were no clear rules. Breaking into someone else's site or computer to mine is a different matter, and is treated as unauthorized access in most countries.
What happened next
According to a report by the German tech outlet Heise, Coinhive stopped its mining service on March 8, 2019, and the entire site, including its website, went offline on April 30, 2019. With the dominant tool gone, browser-based cryptojacking dropped sharply.
Cryptojacking itself did not disappear. It moved to places where attackers get more computing power for longer. Criminals have exploited server software flaws, such as the Microsoft Exchange vulnerabilities in 2021, to install miners on corporate machines. Stolen cloud account credentials are another common target, because a hijacked cloud account can run many powerful servers until the owner notices the bill. The pattern is the same as Coinhive: the attacker keeps the coins, and the victim pays for the electricity and computing time.
How to spot and block cryptojacking today
On your own devices
- Watch for unexplained slowdowns. A fan that spins up on a simple web page, a hot laptop or a battery that drains fast can all be signs of mining. On Windows, open Task Manager; on a Mac, open Activity Monitor; in Chrome or Edge, press Shift+Esc to open the browser's own task manager and see which tab is using the CPU.
- Use built-in protections first. Firefox's Enhanced Tracking Protection includes a setting that blocks known cryptominers. Most reputable ad blockers, including uBlock Origin, use filter lists that block known mining scripts.
- Keep your browser and operating system updated, and close tabs you are not using.
If you run a website or server
- Patch your content management system and plugins promptly. The 2018 wave of government site infections came from a known Drupal flaw.
- Audit third-party scripts that load on your pages, and remove any you do not recognize.
- Set billing alerts on cloud accounts and use multi-factor authentication, so a hijacked account is caught quickly.
- Monitor CPU usage on servers. Sustained high usage with no matching traffic is a classic sign of a hidden miner.
The bottom line
Coinhive promised a fairer alternative to ads and instead became the most widely abused script of its era. Its history shows why consent matters: a business model that only works when people do not know it is happening is not really a business model. The tool is gone, but the lesson about watching what runs on your hardware still applies.
Sources
- Krebs on Security: Who and What Is Coinhive? (March 2018)
- Wikipedia: Cryptojacking
- Wikipedia: Monero (Coinhive and mining design)
- Wikipedia (German): Coinhive, including shutdown dates and earnings estimate
- Wikipedia (Japanese): The Coinhive case in Japanese courts
Top image: "Collection of historical CPUs" by Martijn Boer, Public domain, via Wikimedia Commons (resized). Charts by Thank You Robot.
0 Comments